A response plan your team can use under pressure.
A security incident brings urgent decisions before all the facts are clear. We build on your existing procedures so your team knows how to assess the situation, get help and coordinate the response.
When it helps
When the next steps depend on improvising, finding the right person or piecing together several documents.
An incident would leave too much to work out
Your team can handle individual problems, but there is no shared sequence for checking a report, deciding what needs attention and coordinating the response.
- Define the steps from the first report to response and review.
- Make the decision points and information needed at each stage clear.
- Include initial guidance for recording events and preserving evidence.
Getting help means searching messages and contracts
Different people and providers handle different parts of your systems. Finding the right contact and understanding their available help could slow the response.
- Bring the agreed response contacts and arrangements into one place.
- Clarify when to involve technical specialists and relevant advisers.
- Set out the next step when a contact or service is unavailable.
The plan no longer matches how you work
Systems, providers or people have changed. The document still exists, but some of its instructions may no longer be practical.
- Check the agreed response stages against current arrangements.
- Update contact details, decision points and links to relevant procedures.
- Walk through the revised plan and record gaps that need follow-up.
You know the approach. Writing it keeps slipping.
You already have a clear view of how incidents should be handled, but turning it into guidance the team can follow keeps losing out to other priorities.
- Build on your approach and the procedures already in place.
- Turn them into a connected plan with clear actions and handoffs.
- Walk the team through using and keeping the plan current.
From the first report to a coordinated response.
We agree the parts of your business and types of incident to cover, then build a plan around the people, providers and procedures you can draw on.
Planning around your existing arrangements.
- Review of the relevant procedures, business priorities, response contacts and provider arrangements.
- Defined stages and decision points for reporting, initial assessment, response coordination, recovery coordination and review.
- Clear links to existing escalation, communication and recovery procedures, with missing arrangements identified.
- Contact details and initial evidence guidance, including when to involve technical specialists or legal advisers.
- A walkthrough of how to use the plan, followed by agreed refinements and maintenance guidance.
One shared plan for the next steps.
- A response plan covering the agreed business areas and incident types, with clear stages, actions and decision points.
- A contact and decision guide showing who to involve, available response arrangements and fallbacks.
- Initial guidance for recording events and preserving evidence, with links to relevant supporting procedures.
- Walkthrough findings, unresolved gaps and instructions for using and updating the plan.
Carrying out the response or testing it in depth.
Any further work is optional and agreed separately.
- Live incident handling, emergency cover or response staffing.
- Forensic investigation, technical containment or recovery work.
- Facilitated scenario exercises, detailed incident playbooks or ongoing plan maintenance.
How it works
We handle the drafting and bring the relevant people into the review, building on the response arrangements you already have.
Start with what is in place
We review the documents you have and speak with the relevant people. Together we agree the business areas, incident types and response arrangements to cover, along with the price and timing.
Connect the response steps
We draft the plan around the people and providers available to you. We clarify the actions and decision points, connect supporting procedures and flag arrangements that still need to be confirmed.
Check the plan is usable
We walk the relevant people through finding and using the plan. Together we check that the instructions, contacts and handoffs are clear, then refine the document and record unresolved gaps.
Hand over the plan and upkeep guidance
You receive the plan, contact guide and walkthrough findings. We agree who keeps the material current and explain which changes to your business or response arrangements should prompt an update.
Need a clearer plan for a security incident?
An informal 30-minute call to discuss your response planning needs and whether this service fits.